JP5434441B2 - Authentication ID management system and authentication ID management method - Google Patents

Description

  The present invention relates to an authentication ID management system and an authentication ID management method, and more particularly to an authentication ID management system and an authentication ID management method for performing authentication in an environment having a plurality of authentication devices.

  In recent years, with the development of computer networks such as the Internet and LAN, users can use various services provided by computer systems or computers.

  In general, when using various services provided by a computer system or a computer (hereinafter simply referred to as a computer system), it is determined whether the user is authorized to use the service by authentication. Various systems and servers that perform authentication have been developed.

  Examples of computer systems that provide services include an application server, a file server, and a Web server. Here, an application server will be described as an example. Here, an authentication server will be described as an example of a system or server that performs authentication.

  The application server provides a service to a user who has been authenticated by a predetermined authentication server, but does not provide a service to a user who has been authenticated by other than a predetermined authentication server. Therefore, when a user intends to use different services provided by a plurality of application servers, the user needs to authenticate with an authentication server designated for each application server. However, the user may need to authenticate with different authentication servers. . In this case, the user has to store authentication information (ID, password, etc.) for performing authentication for each authentication server.

  Conventionally, as a method of solving the problem of increasing the number of individual IDs that the user must manage when the number of limited sites such as membership-based Internet sites that require authentication increases, it is associated with the individual IDs of the limited sites. It has been known to provide a unified ID and reduce individual IDs that the user must manage (see, for example, Patent Document 1).

JP 2006-185313 A

  It is not uncommon for multiple authentication servers to exist side by side not only on the Internet but also on corporate networks. In such a network environment, it is desirable that each application server corresponds to as many authentication servers as possible. This is because it contributes to the convenience of the user. However, in such an environment, the conventional technology has a problem that ID management associated with the user cannot be performed on the service providing side. This point will be described below.

  The application server provides various services according to the authority of the user authenticated by the authentication server. For example, it is assumed that a certain user is authenticated as the user B by the authentication server A and can use the service of the application server C. Further, it is assumed that the same user is authenticated as the user E by the authentication server D and can use the service of the application server F.

  At this time, the service provided by the application server C to the user B and the service provided by the application server F to the user E are services provided to the same user, and are contradictory as a whole computer system that provides the service. Should not happen.

  However, for the application server, the user B and the user E can be seen by different users. For this reason, it has been difficult for the application server to provide a consistent service for each user. Further, in a computer system in which application servers operate in cooperation with each other, it becomes increasingly difficult to track the identity of users, and it is very difficult to provide a consistent service for each user. That is, it has been difficult to manage the provision of services to users appropriately so that no contradiction occurs in the entire computer system that provides the services. Even with the above prior art, this problem cannot be solved in an environment where a plurality of authentication servers coexist.

  As described above, when a plurality of authentication servers coexist in a conventional computer system that provides a service, IDs are often managed for each authentication server. Therefore, even for the same user, different IDs are used for each authentication server. There was sometimes. As a result, when authentication servers coexist, it is difficult to manage the ID of the same user in the entire conventional computer system that provides the service.

  One embodiment of the present invention has been made in view of the above points, and provides an authentication ID management system and an authentication ID management method for appropriately providing a consistent service for each user in an environment having a plurality of authentication devices. The purpose is to do.

In order to solve the above-described problem, an embodiment of the present invention provides a network-connected authentication device, an integrated authentication ID management device, and a service providing device that cooperate with each other to authenticate a terminal device and via a network. An authentication ID management system that provides a service, wherein the authentication device is based on a first reception unit that receives an individual authentication ID that is an identifier used for authentication from the terminal device, and the received individual authentication ID. when the first authentication unit, the previous SL first authentication unit has succeeded in authenticating to authenticate the terminal device, a first transmission unit that transmits the authentication success information indicating the successful authentication to the terminal device The integrated authentication ID management device includes an authentication device ID that is an identifier of the authentication device from the terminal device, the individual authentication ID transmitted to the authentication device, and the authentication device When the second receiver for receiving a signal to said authentication success information, the a first verification unit that received the authentication success information to verify whether a successful verification result by the first verification unit is normal, An integrated authentication ID acquisition unit that acquires an integrated authentication ID corresponding to the received authentication device ID and authentication ID with reference to a table that stores the authentication device ID, authentication ID, and integrated authentication ID in association with each other; A second transmitting unit that transmits the acquired integrated authentication ID to the terminal device, wherein the service providing device receives the integrated authentication ID transmitted from the terminal device by the integrated authentication ID management device. And a second verification unit that verifies whether the received integrated authentication ID is normal, and when the verification result by the second verification unit is normal, the terminal device is prepared for each user. Command Service in accordance with the authorization of the authentication ID is an authentication ID management system and a service providing unit for providing via the network.

  In addition, what applied the component, the expression, or arbitrary combinations of the component of one Embodiment of this invention to a method, an apparatus, a system, a computer program, a recording medium, a data structure, etc. is also effective as an aspect of this invention. .

  As described above, according to an embodiment of the present invention, it is possible to provide an authentication ID management system and an authentication ID management method for appropriately providing a consistent service for each user in an environment having a plurality of authentication devices.

It is a block diagram of the computer system of a present Example which provides a service. It is a block diagram of an example of a computer apparatus. 1 is a configuration diagram of a first embodiment of a computer system that provides a service. FIG. It is a flowchart showing an example of the processing procedure of local PC. It is a block diagram of an example of authentication information. It is a flowchart showing an example of the processing procedure of the application server. It is a flowchart showing an example of the processing procedure of the integrated ID management server. It is a block diagram of an example of a mapping table. It is a block diagram of 2nd Example of the computer system which provides a service. It is a flowchart showing an example of the processing procedure of local PC. It is a flowchart showing an example of the processing procedure of the application server. It is a flowchart showing an example of the processing procedure of the integrated ID management server. It is a block diagram of 3rd Example of the computer system which provides a service. It is a flowchart showing an example of the processing procedure of local PC.

  Next, modes for carrying out the present invention will be described based on the following embodiments with reference to the drawings.

  FIG. 1 is a configuration diagram of a computer system of this embodiment that provides a service. As shown in FIG. 1, in a computer system, a local PC 1, a plurality of application servers 2, an integrated ID management server 3 and a plurality of authentication servers 4 are connected via a network 5 such as the Internet or a LAN so that data communication is possible. .

  The local PC 1 is a terminal device operated by a user. The application server 2 is a service providing device that provides a service. The integrated ID management server 3 stores an integrated ID prepared for each user, a server ID that is an identifier of the authentication server 4, and an individual ID managed by the authentication server 4 in association with each other by a mapping table described later. doing.

  Based on a request from the local PC 1 operated by the user, the authentication server 4 authenticates the user who determines whether he / she has the authority to use the service provided by the application server 2 and, for example, an authentication result indicating that the user has been authenticated (for example, Authentication success information) is transmitted to the local PC 1.

  Normally, when using a service provided by the application server 2, a user operating the local PC 1 is requested to authenticate by the authentication server 4 from the application server 2. The application server 2 provides a service according to the user's authority to a user who has been successfully authenticated by the authentication server 4. However, in this embodiment, after successful authentication in the authentication server, the integrated ID corresponding to the server ID and the individual ID is acquired from the integrated ID management server 3, and a service is provided according to the authority of the integrated ID.

  Since the integrated ID is prepared for each user, providing the service in accordance with the authority of the integrated ID causes a contradiction in the entire computer system that provides the service even when a plurality of authentication servers are mixed. The service provision to the user can be appropriately managed so as not to occur.

  The local PC 1, the plurality of application servers 2, the integrated ID management server 3 and the plurality of authentication servers 4 in FIG. 1 are configured as the computer apparatus in FIG. FIG. 2 is a configuration diagram of an example of a computer apparatus.

  The computer device includes an input device 11, an output device 12, a drive device 13, an auxiliary storage device 14, a main storage device 15, an arithmetic processing device 16, and an interface device 17 that are mutually connected by a bus B.

  The input device 11 is a keyboard or a mouse. The input device 11 is used for inputting various signals. The output device 12 is a display device or the like. The output device 12 is used for displaying various windows and data. The interface device 17 is a modem, a LAN card, or the like. The interface device 17 is used for connecting to the network 5.

  The authentication ID management program in the authentication ID management system of this embodiment is at least a part of various programs that control the integrated ID management server 3. A program for controlling the local PC 1, the plurality of application servers 2, the integrated ID management server 3 and the plurality of authentication servers 4 is provided by distributing the recording medium 18, downloading from the network 5, or the like.

  The recording medium 18 on which the program is recorded is a recording medium that records information optically, electrically, or magnetically, such as a CD-ROM, a flexible disk, or a magneto-optical disk, and information is electrically stored such as a ROM or a flash memory. Various types of recording media, such as a semiconductor memory for recording data, can be used.

  When the recording medium 18 on which the program is recorded is set in the drive device 13, the program is installed from the recording medium 18 to the auxiliary storage device 14 via the drive device 13. The program downloaded from the network 5 is installed in the auxiliary storage device 14 via the interface device 17.

  The auxiliary storage device 14 stores the installed program and necessary files, data, and the like. The main storage device 15 reads the program from the auxiliary storage device 14 and stores it when the program is started. The arithmetic processing unit 16 implements various processes as will be described later in accordance with a program stored in the main storage unit 15.

  FIG. 3 is a block diagram of a first embodiment of a computer system for providing a service. In the computer system shown in FIG. 3, a local PC 1, application servers 2-1 and 2-2, an integrated ID management server 3, and authentication servers 4-1 and 4-2 are connected via a network 5 so that data communication is possible. . In the following description, an example in which two application servers 2 and authentication servers 4 are connected to the network 5 is shown, but an example in which three or more application servers 2 and authentication servers 4 are connected is also the same.

  The local PC 1 includes an authentication information input unit 21, an application server access unit 22, an authentication processing unit 23, a communication processing unit 24, an authentication server selection unit 25, and an integrated ID management server access unit 26. The application server 2-1 includes a communication processing unit 31, an authentication processing unit 32 corresponding to the authentication server 4-1, and a service providing unit 33. The application server 2-2 includes a communication processing unit 31, an authentication processing unit 32 corresponding to the authentication server 4-2, and a service providing unit 33. In addition, when any of the application servers 2-1 and 2-2 may be used, they are collectively referred to as the application server 2.

  The integrated ID management server 3 includes a communication processing unit 41, an integrated ID acquisition processing unit 42, and an integrated ID storage unit 43. The authentication servers 4-1 and 4-2 include a communication processing unit 51, an authentication processing unit 52, and an authentication information storage unit 53. In addition, when any of the authentication servers 4-1 and 4-2 may be used, they are collectively referred to as an authentication server 4. The local PC 1, the application servers 2-1 and 2-2, the integrated ID management server 3, the authentication servers 4-1 and 4-2 can communicate with the network 5 via the communication processing units 24, 31, 41, and 51, respectively. It is connected to the.

  The processing procedure of the local PC 1, application server 2, and integrated ID management server 3 constituting the computer system of FIG. 3 will be described with reference to a flowchart. FIG. 4 is a flowchart showing an example of the processing procedure of the local PC.

  For example, when using the service provided by the application server 2-1, the user operates the local PC 1 and requests the use of the service provided by the application server 2-1. In step S11, the application server access unit 22 of the local PC 1 requests the application server 2-1 to provide a service.

  In step S12, the authentication processing unit 23 of the local PC 1 determines whether authentication is required for using the service provided by the application server 2-1. When the integrated ID is requested from the application server 2-1, the authentication processing unit 23 determines that authentication is necessary in step S12. The authentication server selection unit 25 proceeds to step S13 and selects the authentication server 4-1 corresponding to the authentication processing unit 32 of the application server 2-1. Selection of the authentication server 4-1 can be instructed from the application server 2-1, for example, by using the HTTP protocol. Note that the user may select the authentication server 4-1 in step S13.

  In step S14, the authentication processing unit 23 accesses the authentication processing unit 52 of the selected authentication server 4-1, and performs user authentication. The authentication processing unit 52 of the authentication server 4-1 performs authentication using the authentication information of FIG. 5 stored and managed in the authentication information storage unit 53, for example.

  FIG. 5 is a configuration diagram of an example of authentication information. The authentication information in FIG. 5 manages individual IDs and passwords in association with each other. For example, the authentication processing unit 52 of the authentication server 4-1 determines that the authentication is successful if the authentication information storage unit 53 includes the combination of the individual ID and password received from the authentication processing unit 23 of the local PC 1. To do. When the authentication is successful, the authentication processing unit 52 of the authentication server 4-1 transmits authentication success information that is information indicating authentication to the authentication processing unit 23 of the local PC 1.

  In step S15, the authentication processing unit 23 of the local PC 1 determines whether or not the authentication is successful depending on whether or not authentication success information, which is information indicating that the authentication server 4-1, has been authenticated, has been received from the authentication server 4-1. Determine.

  When the authentication success information, which is information indicating that the authentication server 4-1 is authenticated, is received from the authentication server 4-1, the authentication processing unit 23 determines that the authentication is successful. If it is determined that the authentication is successful, the integrated ID management server access unit 26 proceeds to step S16 and accesses the integrated ID management server 3.

  The integrated ID management server access unit 26 is authenticated by the authentication server 4-1, authentication success information that is information indicating that the authentication server 4-1 is authenticated, a server ID that is an identifier of the authentication server 4-1, and the authentication server 4-1. The individual ID used for authentication is transmitted to the integrated ID management server 3. The integrated ID management server 3 acquires an integrated ID from the received authentication success information, server ID, and individual ID as described later, and transmits it to the integrated ID management server access unit 26 of the local PC 1.

  In step S17, the integrated ID management server access unit 26 determines whether the acquisition of the integrated ID is successful based on whether the integrated ID is received from the integrated ID acquisition processing unit 42 of the integrated ID management server 3.

  When the integrated ID is received from the integrated ID acquisition processing unit 42 of the integrated ID management server 3, the integrated ID management server access unit 26 determines that the acquisition of the integrated ID is successful. If it is determined that acquisition of the integrated ID is successful, the application server access unit 22 of the local PC 1 proceeds to step S18, and requests the application server 2-1 to provide a service with the integrated ID. In step S19, the application server access unit 22 receives a service provided from the application server 2-1.

  If the authentication has been completed, the authentication processing unit 23 determines in step S12 that authentication is not necessary. If it is determined that authentication is not necessary, the application server access unit 22 proceeds to step S19, and receives service from the application server 2-1. On the other hand, if the authentication success information is not received from the authentication server 4-1, the authentication processing unit 23 determines that the authentication has failed in step S15, and ends the process of the flowchart illustrated in FIG. If the integrated ID is not received from the integrated ID acquisition processing unit 42 of the integrated ID management server 3, the integrated ID management server access unit 26 determines in step S17 that acquisition of the integrated ID has failed. If the integrated ID management server access unit 26 determines that the acquisition of the integrated ID has failed, the authentication processing unit 23 ends the process of the flowchart shown in FIG.

  FIG. 6 is a flowchart showing an example of the processing procedure of the application server. In step S21, the service providing unit 33 of the application server 2-1 is requested to provide a service from the application server access unit 22 of the local PC 1.

  In step S22, the authentication processing unit 32 of the application server 2-1 determines whether an integration ID is attached to the service provision request from the local PC 1. If the integrated ID is not attached to the service provision request, the process proceeds to step S23, and the authentication processing unit 32 of the application server 2-1 requests the integrated ID from the authentication processing unit 23 of the local PC 1, and then proceeds to the process of step S21. Return.

  If the integrated ID is attached to the service provision request, the authentication processing unit 32 of the application server 2-1 proceeds to step S24 and determines whether the authentication is successful. The authentication processing unit 32 determines that the authentication is successful if a normal integrated ID is attached. If it is determined that the authentication is successful, the service providing unit 33 proceeds to step S25, and provides the service requested from the application server access unit 22 of the local PC 1.

  In step S24, the authentication processing unit 32 determines that the authentication has failed if an abnormal integrated ID is attached. Here, in order to verify the normality of the integrated ID, for example, the integrated ID management server gives an electronic signature to the integrated ID based on a predetermined secret key, and the authentication processing unit 32 determines the predetermined application server 2- 1 may receive the electronic signature together with the integrated ID via the local PC 1, and the authentication processing unit 32 may verify the electronic signature based on a predetermined public key. If it is determined that the authentication has failed, the service providing unit 33 proceeds to step S26 and returns an error to the application server access unit 22 of the local PC 1.

  FIG. 7 is a flowchart showing an example of the processing procedure of the integrated ID management server. Proceeding to step S31, the integrated ID acquisition processing unit 42 of the integrated ID management server 3 includes authentication success information that is information indicating that the authentication is performed by the authentication server 4-1 from the integrated ID management server access unit 26 of the local PC 1. A server ID that is an identifier of the authentication server 4-1 and an individual ID used for authentication performed by the authentication server 4-1 are acquired.

  In step S32, the integrated ID acquisition processing unit 42 verifies the authentication success information acquired in step S31. If the verification result of the authentication success information is normal, the integrated ID acquisition processing unit 42 proceeds to step S33 and refers to, for example, the mapping table of FIG. 8 stored and managed in the integrated ID storage unit 43.

  FIG. 8 is a configuration diagram of an example of the mapping table. The mapping table of FIG. 8 stores a server ID, which is an identifier of the authentication server 4, an individual ID managed by the authentication server 4, and an integrated ID prepared for each user in association with each other.

  The integrated ID acquisition processing unit 42 acquires an integrated ID corresponding to the server ID that is the identifier of the authentication server 4-1 acquired in step S31 and the individual ID used for authentication performed by the authentication server 4-1. .

  In step S34, the integrated ID acquisition processing unit 42 determines whether the integrated ID has been acquired in step S33. If the integrated ID can be acquired, the integrated ID acquisition processing unit 42 proceeds to step S35, and transmits the integrated ID to the integrated ID management server access unit 26 of the local PC 1.

  If the verification result of the authentication success information is abnormal in step S32, the integrated ID acquisition processing unit 42 proceeds to step S36 and returns an error to the integrated ID management server access unit 26 of the local PC 1. If the integrated ID cannot be acquired in step S34, the integrated ID acquisition processing unit 42 proceeds to step S36 and returns an error to the integrated ID management server access unit 26 of the local PC 1.

  In the computer system of FIG. 3, an example in which the integrated ID is acquired by the local PC 1 is shown. However, the application server 2 may instruct the application server access unit 22 of the local PC 1 in a script language or the like. . The application server access unit 22 is realized by a browser or the like, for example.

  FIG. 9 is a block diagram of a second embodiment of a computer system for providing a service. The computer system shown in FIG. 9 differs from the computer system shown in FIG. 3 in the configuration of the local PC 1 and application servers 2-1 and 2-2. Specifically, the local PC 1 of the computer system shown in FIG. 9 has a configuration in which the integrated ID management server access unit 26 is removed from the local PC 1 of the computer system shown in FIG. Further, the application servers 2-1 and 2-2 of the computer system shown in FIG. 9 are connected to the authentication processing unit 32 of the application servers 2-1 and 2-2 of the computer system shown in FIG. It is the structure replaced with.

  The processing procedure of the local PC 1, application server 2, and integrated ID management server 3 constituting the computer system of FIG. 9 will be described with reference to a flowchart. FIG. 10 is a flowchart showing an example of the processing procedure of the local PC.

  Steps S41 to S45 are the same as steps S11 to S15 in FIG. If it progresses to step S45 and it determines with authentication having been successful, the application server access part 22 of local PC1 will progress to step S46. The application server access unit 22 includes authentication success information that is information indicating that the authentication server 4-1 has been authenticated, a server ID that is an identifier of the authentication server 4-1, and authentication performed by the authentication server 4-1. The application server 2-1 is requested to provide a service with the individual ID used for. In step S47, the application server access unit 22 receives a service provided from the application server 2-1.

  FIG. 11 is a flowchart showing an example of the processing procedure of the application server. In step S51, the service providing unit 33 of the application server 2-1 is requested to provide a service from the application server access unit 22 of the local PC 1. In step S52, the integrated ID management server access unit 34 of the application server 2-1 determines whether authentication request information, server ID, and individual ID are attached to the service provision request from the local PC 1.

  If the integrated ID management server access unit 34 of the application server 2-1 does not include the authentication success information, the server ID, and the individual ID in the service provision request, the process proceeds to step S53, and the authentication processing unit 23 of the local PC 1 receives the authentication success information. After requesting the server ID and the individual ID, the process returns to step S51.

  If the service provision request includes authentication success information, server ID, and individual ID, the integrated ID management server access unit 34 of the application server 2-1 proceeds to step S54 and accesses the integrated ID management server 3.

  The integrated ID management server access unit 34 transmits the authentication success information, the server ID, and the individual ID attached to the service provision request to the integrated ID management server 3. The integrated ID management server 3 acquires the integrated ID from the received authentication success information, server ID, and individual ID as described above, and transmits it to the integrated ID management server access unit 34 of the application server 2-1.

  In step S55, the integrated ID management server access unit 34 determines whether or not the acquisition of the integrated ID is successful depending on whether or not the integrated ID is received from the integrated ID acquisition processing unit 42 of the integrated ID management server 3.

  When the integrated ID is received from the integrated ID acquisition processing unit 42 of the integrated ID management server 3, the integrated ID management server access unit 34 determines that the acquisition of the integrated ID is successful. If it is determined that acquisition of the integrated ID is successful, the service providing unit 33 proceeds to step S56 and provides the service requested from the application server access unit 22 of the local PC 1.

  If the integrated ID is not received from the integrated ID acquisition processing unit 42 of the integrated ID management server 3 in step S55, the integrated ID management server access unit 34 determines that the acquisition of the integrated ID has failed in step S55. If it is determined that acquisition of the integrated ID has failed, the integrated ID management server access unit 34 proceeds to step S57 and returns an error to the application server access unit 22 of the local PC 1.

  FIG. 12 is a flowchart showing an example of the processing procedure of the integrated ID management server. The integrated ID acquisition processing unit 42 of the integrated ID management server 3 proceeds to step S61, and acquires authentication success information, a server ID, and an individual ID from the integrated ID management server access unit 34 of the application server 2-1.

  In step S62, the integrated ID acquisition processing unit 42 verifies the authentication success information acquired in step S61. If the verification result of the authentication success information is normal, the integrated ID acquisition processing unit 42 proceeds to step S63 and refers to the mapping table of FIG. 8 stored and managed in the integrated ID storage unit 43, for example.

  The integrated ID acquisition processing unit 42 acquires an integrated ID corresponding to the server ID and individual ID acquired in step S61. In step S64, the integrated ID acquisition processing unit 42 determines whether the integrated ID has been acquired in step S63. If the integrated ID can be acquired, the integrated ID acquisition processing unit 42 proceeds to step S65, and transmits the integrated ID to the integrated ID management server access unit 34 of the application server 2-1.

  If the verification result of the authentication success information is abnormal in step S62, the integrated ID acquisition processing unit 42 proceeds to step S66 and returns an error to the integrated ID management server access unit 34 of the application server 2-1. If the integrated ID cannot be acquired in step S64, the integrated ID acquisition processing unit 42 proceeds to step S66 and returns an error to the integrated ID management server access unit 34 of the application server 2-1. In the computer system of FIG. 9, an example in which the integrated ID is acquired by the application server 2-1 is illustrated.

  In the computer system of FIGS. 3 and 9, in the offline environment, the local PC 1 cannot access the application server 2, and naturally, the service cannot be received from the application server 2.

  On the other hand, a service that can be used on the local PC 1 is not only provided from the remote application server 2 but also from an application that operates on the local PC 1. Since the service provided by the application running on the local PC 1 needs to be provided to an appropriate user, the local PC 1 performs authentication when providing the service.

  Generally, the authentication server 4 that manages the authentication information of the entire computer system exists remotely. Therefore, the local PC 1 cannot perform authentication in the offline environment.

  In order to solve the above problem, it has been conventionally known that authentication information is stored on the local PC 1 and authentication is performed using the stored authentication information in an offline environment (for example, Japanese Patent Laid-Open No. 2003-2003). -85142). However, a method of storing authentication information on the local PC 1 and performing authentication using the stored authentication information in an offline environment is not necessarily safe because the authentication information is set by the user. Further, the method of storing the authentication information on the local PC 1 cannot reflect the latest authentication information managed by the authentication server 4 to the authentication information stored in the local PC 1. For this reason, the method of storing the authentication information on the local PC 1 has a risk that a user who has been unregistered by the authentication server 4 can continue to log on to the local PC 1.

  Therefore, the computer system of this embodiment solves the above problem as follows. FIG. 13 is a block diagram of a third embodiment of a computer system for providing a service. The computer system shown in FIG. 13 is different from the computer system shown in FIG. 3 in the configuration of the local PC 1. Specifically, the local PC 1 of the computer system shown in FIG. 13 has a configuration in which an authentication information storage unit 27 is added to the local PC 1 of the computer system shown in FIG.

  The processing procedure of the local PC 1 configuring the computer system of FIG. 13 will be described with reference to the flowchart of FIG. FIG. 14 is a flowchart showing an example of the processing procedure of the local PC.

  For example, when using a service provided by an application (not shown) that operates on the local PC 1, the user operates the local PC 1 to request use of a service provided by an application that operates on the local PC 1. In step S71, the application server access unit 22 of the local PC 1 requests the application running on the local PC 1 to provide a service.

  In step S72, the authentication processing unit 23 of the local PC 1 determines whether authentication is required for using a service provided by an application operating on the local PC 1. If the authentication processing unit 23 determines that authentication is necessary, the process proceeds to step S73, and determines whether or not the online environment.

  If it is an online environment, the authentication server selection unit 25 proceeds to step S74, and selects the authentication server 4-1 corresponding to the application operating on the local PC 1. Note that the user may select the authentication server 4-1 in step S74.

  In step S75, the authentication processing unit 23 accesses the authentication processing unit 52 of the selected authentication server 4-1, and performs user authentication. When the authentication is successful, the authentication processing unit 52 of the authentication server 4-1 transmits authentication success information that is information indicating authentication to the authentication processing unit 23 of the local PC 1.

  In step S76, the authentication processing unit 23 of the local PC 1 determines whether or not the authentication is successful depending on whether or not authentication success information, which is information indicating that the authentication server 4-1, has been authenticated, has been received from the authentication server 4-1. Determine.

  When the authentication success information, which is information indicating that the authentication server 4-1 is authenticated, is received from the authentication server 4-1, the authentication processing unit 23 determines that the authentication is successful. If it is determined that the authentication is successful, the integrated ID management server access unit 26 proceeds to step S77 and accesses the integrated ID management server 3.

  The integrated ID management server access unit 26 is authenticated by the authentication server 4-1, authentication success information that is information indicating that the authentication server 4-1 is authenticated, a server ID that is an identifier of the authentication server 4-1, and the authentication server 4-1. The individual ID used for authentication is transmitted to the integrated ID management server 3. The integrated ID management server 3 acquires an integrated ID from the received authentication success information, server ID, and individual ID, and transmits it to the integrated ID management server access unit 26 of the local PC 1.

  In step S78, the integrated ID management server access unit 26 determines whether the acquisition of the integrated ID is successful based on whether the integrated ID is received from the integrated ID acquisition processing unit 42 of the integrated ID management server 3.

  When the integrated ID is received from the integrated ID acquisition processing unit 42 of the integrated ID management server 3, the integrated ID management server access unit 26 determines that the acquisition of the integrated ID is successful. If it is determined that acquisition of the integrated ID is successful, the authentication processing unit 23, as information used for authentication, is authentication success information that is information indicating that the authentication server 4-1 has been authenticated, and an identifier of the authentication server 4-1. And the authentication information (individual ID, password) used for authentication performed by the authentication server 4-1, and the integrated ID of the user are stored in the authentication information storage unit 27 together with the valid time. .

  In step S80, the application server access unit 22 of the local PC 1 attaches the integrated ID and requests the application operating on the local PC 1 to provide the service. Proceeding to step S81, the application server access unit 22 receives provision of a service from an application operating on the local PC 1.

  On the other hand, if the online environment is not determined in step S73, the authentication processing unit 23 proceeds to step S82, and determines whether the information used for authentication stored in the authentication information storage unit 27 is valid (within the period) based on the valid time. If the information used for authentication stored in the authentication information storage unit 27 is valid, the authentication processing unit 23 proceeds to step S83 and causes the user to input authentication information (individual ID, password) from the authentication information input unit 21.

  In step S84, the authentication processing unit 23 determines whether the authentication information input to the user in step S83 matches the authentication information stored in the authentication information storage unit 27. If the authentication information input to the user in step S83 matches the authentication information stored in the authentication information storage unit 27, the process proceeds to step S80, and the application server access unit 22 of the local PC 1 is stored in the authentication information storage unit 27. A service provision is requested to the application operating on the local PC 1 with the integrated ID. Proceeding to step S81, the application server access unit 22 receives provision of a service from an application operating on the local PC 1.

  If the authentication has been completed, the authentication processing unit 23 determines in step S72 that authentication is not necessary. If it is determined that authentication is not required, the application server access unit 22 proceeds to step S81 and receives a service provided from an application operating on the local PC 1.

  On the other hand, if the authentication success information is not received from the authentication server 4-1, the authentication processing unit 23 determines that the authentication has failed in step S76, and ends the process of FIG. If the integrated ID is not received from the integrated ID acquisition processing unit 42 of the integrated ID management server 3, the integrated ID management server access unit 26 determines that the acquisition of the integrated ID has failed in step S78, and ends the process of FIG. To do. When the information used for authentication stored in the authentication information storage unit 27 is not valid in step S82, the authentication information input to the user in step S83 in step S84 and the authentication information stored in the authentication information storage unit 27 are obtained. If they do not match, the processing in FIG. 14 is terminated.

  In the computer system of FIG. 13, information used for authentication is stored on the local PC 1, and authentication information (individual ID, password) input by the user from the authentication information input unit 21 when logging on in an offline environment is It is determined whether or not it matches the authentication information stored in the authentication information storage unit 27.

  The authentication information stored in the authentication information storage unit 27 becomes the latest authentication information by finally using the information used for authentication in the authentication server 4-1. If the authentication server 4-1 does not authenticate for a certain period of time, the authentication information stored in the authentication information storage unit 27 becomes invalid, so that it is guaranteed that the authentication information is the latest or close to the latest information.

  As described above, in the computer system of FIG. 13, when authentication is performed from the local PC 1 using the authentication server 4-1, the authentication information is stored in the authentication information storage unit 27, and the user enters the authentication information input unit 21 in the offline environment. The service is provided when the authentication information input from the above matches the authentication information stored in the authentication information storage unit 27.

  Therefore, the computer system of FIG. 13 can obtain high reliability for authentication even in an offline environment.

  The present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.

1 Local PC
2,2-1,2-2 Application server 3 Integrated ID management server 4,4-1,4-2 Authentication server 5 Network 11 Input device 12 Output device 13 Drive device 14 Auxiliary storage device 15 Main storage device 16 Arithmetic processing device DESCRIPTION OF SYMBOLS 17 Interface apparatus 21 Authentication information input part 22 Application server access part 23 Authentication process part 24 Communication process part 25 Authentication server selection part 26 Integrated ID management server access part 27 Authentication information storage part 31 Communication process part 32 Authentication process part 33 Service provision part 34 Integrated ID management server access unit 41 Communication processing unit 42 Integrated ID acquisition processing unit 43 Integrated ID storage unit 51 Communication processing unit 52 Authentication processing unit 53 Authentication information storage unit 53
B bus

Claims (3)

An authentication ID management system in which a network-connected authentication device, an integrated authentication ID management device, and a service providing device cooperate to authenticate a terminal device and provide a service via a network,
The authentication device
A first receiving unit that receives an individual authentication ID that is an identifier used for authentication from the terminal device;
A first authenticating unit for authenticating the terminal device based on the received individual authentication ID;
When the first authentication unit before SL has been successfully authenticated, and a first transmission unit that transmits the authentication success information indicating the successful authentication to the terminal device,
The integrated authentication ID management device includes:
A second receiving unit that receives an authentication device ID that is an identifier of the authentication device from the terminal device, the individual authentication ID transmitted to the authentication device, and the authentication success information transmitted by the authentication device;
A first verification unit for verifying whether the received authentication success information is normal;
When the verification result by the first verification unit is normal, the authentication apparatus ID, the authentication ID, and the integrated authentication ID are referred to and a table stored in association with each other is referenced to correspond to the received authentication apparatus ID and authentication ID. An integrated authentication ID acquisition unit for acquiring an integrated authentication ID;
A second transmitter that transmits the acquired integrated authentication ID to the terminal device;
The service providing apparatus includes:
A third receiving unit that receives the integrated authentication ID transmitted from the terminal device by the integrated authentication ID management device;
A second verification unit for verifying whether the received integrated authentication ID is normal;
A service providing unit that provides a service according to the authority of the integrated authentication ID prepared for each user to the terminal device via a network when the verification result by the second verification unit is normal; Authentication ID management system. The terminal device
The authentication device ID that is an identifier of the authentication device, the individual authentication ID transmitted to the authentication device, the authentication success information received from the authentication device, and the integrated authentication ID received from the integrated authentication ID management device And a storage unit that stores in a storage device as information used for authentication ,
The authentication according to claim 1, further comprising: a second authentication unit that performs authentication based on the individual authentication ID input from a user and the individual authentication ID read from the storage unit when not in an online environment. ID management system. An authentication ID management method in which a network-connected authentication device, an integrated authentication ID management device, and a service providing device cooperate to authenticate a terminal device and provide a service via a network,
A first receiving step in which the authentication device receives an individual authentication ID that is an identifier used for authentication from the terminal device;
An authentication step in which the authentication device authenticates the terminal device based on the received individual authentication ID;
The authentication device, when the front Ki認 card steps have been successfully authenticated, the first transmission step of transmitting the authentication success information indicating the successful authentication to the terminal device,
The integrated authentication ID management device receives an authentication device ID that is an identifier of the authentication device from the terminal device, the individual authentication ID transmitted to the authentication device, and the authentication success information transmitted by the authentication device. A second receiving step,
A first verification step in which the integrated authentication ID management device verifies whether the received authentication success information is normal;
When the verification result in the first verification step is normal, the integrated authentication ID management device refers to a table in which the authentication device ID, the authentication ID, and the integrated authentication ID are stored in association with each other, and the received authentication device An integrated authentication ID acquisition step of acquiring an integrated authentication ID corresponding to the ID and the authentication ID;
A second transmission step in which the integrated authentication ID management device transmits the acquired integrated authentication ID to the terminal device;
A third receiving step in which the service providing apparatus receives the integrated authentication ID transmitted from the terminal apparatus by the integrated authentication ID management apparatus;
A second verification step in which the service providing apparatus verifies whether the received integrated authentication ID is normal;
When the verification result in the second verification step is normal, the service providing apparatus provides a service according to the authority of the integrated authentication ID prepared for each user to the terminal apparatus via the network. An authentication ID management method comprising a service providing step.

Images